MdeModulePkg/HiiImage: Fix stack overflow when corrupted BMP is parsed (CVE-2018...

[mirror_edk2.git] / MdeModulePkg / Universal / HiiDatabaseDxe / Image.c

diff --git a/MdeModulePkg/Universal/HiiDatabaseDxe/Image.c b/MdeModulePkg/Universal/HiiDatabaseDxe/Image.c
index 80a4ec11148d61337e6f4a640b8972250c57656b..8532f272eb54da2255a798433656e94e883b157d 100644 (file)
--- a/MdeModulePkg/Universal/HiiDatabaseDxe/Image.c
+++ b/MdeModulePkg/Universal/HiiDatabaseDxe/Image.c
@@ -370,7 +370,7 @@ Output4bitPixel (
   PaletteNum = (UINT16)(Palette->PaletteSize / sizeof (EFI_HII_RGB_PIXEL));\r
 \r
   ZeroMem (PaletteValue, sizeof (PaletteValue));\r
-  CopyRgbToGopPixel (PaletteValue, Palette->PaletteValue, PaletteNum);\r
+  CopyRgbToGopPixel (PaletteValue, Palette->PaletteValue, MIN (PaletteNum, ARRAY_SIZE (PaletteValue)));\r
   FreePool (Palette);\r
 \r
   //\r
@@ -447,7 +447,7 @@ Output8bitPixel (
   CopyMem (Palette, PaletteInfo, PaletteSize);\r
   PaletteNum = (UINT16)(Palette->PaletteSize / sizeof (EFI_HII_RGB_PIXEL));\r
   ZeroMem (PaletteValue, sizeof (PaletteValue));\r
-  CopyRgbToGopPixel (PaletteValue, Palette->PaletteValue, PaletteNum);\r
+  CopyRgbToGopPixel (PaletteValue, Palette->PaletteValue, MIN (PaletteNum, ARRAY_SIZE (PaletteValue)));\r
   FreePool (Palette);\r
 \r
   //\r